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Hail Insurance System A udit (00D P-06) 


Introduction 


The M ontana Hail Insurance Program provides hail insurance coverage on any crop grown in 
Montana. The program works closely with private insurance providers in the state, since many 
producers carry both state and private hail insurance. According to 1999 fiscal year-end 
reports, hail insurance premiums collected for the State H ail Insurance Program totaled 
$2,827,338. 


We performed an information system audit of the computerized Hail Insurance System, HAIL, 
administered by the Department of Agriculture. HAIL was created by the department and 
replaced the previous system in] uly 1999. This new system contains state insurance policy 
data, including, policy, loss claim, and payment information. The system interfaces accounts 
receivable information with the Statewide Accounting, Budgeting and Human Resource System 
(SABHRS). 


Insurance policy forms are sent to the department for data entry into HAIL. HAIL calculates 
the total risk, premium and loss payment amounts according to the data entered. Premium 
amounts are based on the number of acres and the amount of coverage desired per acre, as well 
as the county in which the land lies and the type of crop grown. Loss claim forms are 
submitted to the H elena office, and hail insurance adjusters verify the amount of crop damage. 
Claim amounts are calculated by the system and verified against manual calculations prepared 
by adjusters. Claim amounts are determined by multiplying the acres damaged by the 
percentage of damage this storm, and then multiplied by the amount of coverage per acre. 

Loss payments are offset against outstanding premiums before checks are sent to policyholders. 


HAIL also calculates the yearly distribution of funds to the state General Fund (2 percent) and 
the collecting counties (1.5 percent). The distribution is based on a percentage of premiums 
collected during the year less payments for loss claims. Payments are calculated annually in 
February, and had not been calculated on the HAIL system at the time of our audit. 
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Audit Objectives 


The objectives of this audit included ensuring hail insurance polices are input completely and 
accurately, and to ensure that risk and premium amounts are calculated accurately by the 
system. We reviewed controls to ensure cash collections, accounts receivable updates, and loss 
payments are processed completely and accurately. We also performed testing to verify access 
to data files and programs is limited to appropriate personnel, to ensure critical data fields 
converted accurately, and to verify that disaster recovery is documented and backup procedures 
are performed. 


Audit Scope and M ethodology 


The audit was conducted in accordance with governmental auditing standards published by the 
United States General A ccounting Office. We evaluated controls implemented over HAIL by 
comparing the department’s controls against criteria established by the A merican Institute of 
Certified Public Accountants and the electronic data processing industry. 


During the audit, we reviewed hail insurance policies to verify critical fields were input 
correctly. Werecalculated at-risk and premium amounts to ensure the system is calculating 
amounts accurately. We verified reports of policy input are complete based on policy 
information input. 


We verified accounts receivable batch update reports were accurate based on policy input and 
collections and that the report is reviewed and approved by appropriate personnel. We verified 
procedures were in place for identifying and correcting rejected transactions. We verified that 
collections are updated to HAIL completely and accurately based on collection amounts posted 
to SABHRS. 


We reviewed loss claims received and verified that critical fields were input accurately. We 
recalculated loss payment amounts to verify that payments are calculated accurately. We 
verified that appropriate personnel approve loss claims prior to payment. 


We reviewed electronic access controls to determine if access privileges are granted according 
to users’ responsibility for entering policy and loss information, transferring data to SABHRS, 
and system maintenance. We reviewed password parameters to ensure they are in compliance 
with state policy. We reviewed the conversion process as well as supporting documentation, 
and verified that critical fields converted accurately. We reviewed disaster recovery policies 
and procedures. 


Based on testing performed, we found controls to be effective over the HAIL system 
regarding input, processing, output, and system security. 
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Audit Summary 


During the audit, we identified password parameters, documented disaster recovery, and a data 
conversion concern deemed not to have a significant effect on the successful operation of the 
State Hail Insurance Program. The current system version does not require the password 
parameters required in state policy, and a third party security software is cost prohibitive. 
Department personnel stated that they intend to upgrade in the future, which could provide the 
necessary password security. Currently, personnel are advised by department personnel to 
change HAIL passwords along with required network changes. Although the department has 
not documented its disaster recovery procedures, the department currently performs back-ups 
that are stored off-site. From the entire population, one isolated instance was identified in the 
conversion data. Agency personnel stated the conversion error would have been identified later 
in the year when reconciliations would have been performed prior to processing the 1.5 percent 
payment to counties and the 2 percent payment to the General Fund. The concerns are not 
specifically addressed in a report, but have been discussed with department management. 


We would like to thank the agency for their help in performing the audit. 


wk/edp/hail memo.doc/bjh 
OODP-06 


